通过分析模型层间状态变化，实时检测大模型运行时异常行为。
Layerwise Convergence Fingerprints for Runtime Misbehavior Detection in Large Language Models
- 不依赖参考模型或触发样本，直接监控层间隐状态轨迹。
- 在四种模型上将后门攻击成功率降至1%以下，误报率仅12%-16%。
- 无需针对不同威胁调参，适合云服务和设备端通用部署。
部署在运行时的大语言模型可能表现出训练数据验证无法预见的异常行为：训练时植入的后门在触发前处于休眠状态，越狱攻击会绕过安全对齐，提示注入可覆盖部署者的指令。现有运行时防御通常针对单一威胁，且常依赖干净参考模型、触发知识或可编辑权重，这些假设在第三方闭源模型中很少成立。本文提出层间收敛指纹（LCF），一种无需微调的运行时监测机制，将层间隐藏状态轨迹视为健康信号：计算每层间差异的对角马氏距离，通过Ledoit-Wolf收缩聚合，并基于200个干净样本进行留一法校准阈值，无需参考模型、触发知识或重训练。在四个架构（Llama-3-8B、Qwen2.5-7B、Gemma-2-9B、Qwen2.5-14B）上评估，涵盖后门（56种组合）、越狱（3种技术）和提示注入（BIPIA邮件+代码问答），LCF使Qwen2.5-7B和Gemma-2的平均后门攻击成功率（ASR）低于1%，在Qwen2.5-14B上为1.3%；检测92-100%的DAN越狱（GCG和软角色扮演为62-100%）；对所有八个（模型，领域）组合中的文本载荷注入实现100%检测，后门误报率12-16%，推理开销小于0.1%。单一聚合分数即可覆盖三类威胁，无需特定调参，可作为云端和终端大模型的通用运行时安全层。
原文摘要 · Abstract (English)
Large language models deployed at runtime can misbehave in ways that clean-data validation cannot anticipate: training-time backdoors lie dormant until triggered, jailbreaks subvert safety alignment, and prompt injections override the deployer's instructions. Existing runtime defenses address these threats one at a time and often assume a clean reference model, trigger knowledge, or editable weights, assumptions that rarely hold for opaque third-party artifacts. We introduce Layerwise Convergence Fingerprinting (LCF), a tuning-free runtime monitor that treats the inter-layer hidden-state trajectory as a health signal: LCF computes a diagonal Mahalanobis distance on every inter-layer difference, aggregates via Ledoit-Wolf shrinkage, and thresholds via leave-one-out calibration on 200 clean examples, with no reference model, trigger knowledge, or retraining. Evaluated on four architectures (Llama-3-8B, Qwen2.5-7B, Gemma-2-9B, Qwen2.5-14B) across backdoors, jailbreaks, and prompt injection (56 backdoor combinations, 3 jailbreak techniques, and BIPIA email + code-QA), LCF reduces mean backdoor attack success rate (ASR) below 1% on Qwen2.5-7B and Gemma-2 and to 1.3% on Qwen2.5-14B, detects 92-100% of DAN jailbreaks (62-100% for GCG and softer role-play), and flags 100% of text-payload injections across all eight (model, domain) cells, at 12-16% backdoor FPR and <0.1% inference overhead. A single aggregation score covers all three threat families without threat-specific tuning, positioning LCF as a general-purpose runtime safety layer for cloud-served and on-device LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。